diff --git a/files/templates/authforms.html b/files/templates/authforms.html
index 198c27589..b0345d648 100644
--- a/files/templates/authforms.html
+++ b/files/templates/authforms.html
@@ -2,6 +2,7 @@
 <html lang="en">
 
 <head>
+		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
 
 		<meta charset="utf-8">
 		<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
diff --git a/files/templates/default.html b/files/templates/default.html
index 9e5c8718b..528eaf950 100644
--- a/files/templates/default.html
+++ b/files/templates/default.html
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
+	<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' 'unsafe-eval' ajax.cloudflare.com; connect-src 'self' tls-use1.fpapi.io api.fpjs.io 02ddcc80-b8db-42be-9022-44c546b4dce6.pushnotifications.pusher.com; object-src 'none';">
+
 	<script src="/assets/js/bootstrap.js?v=1"></script>
 	{% if v %}
 		<style>:root{--primary:#{{v.themecolor}}}</style>
diff --git a/files/templates/email/default.html b/files/templates/email/default.html
index b81768cd0..372d9b9ce 100644
--- a/files/templates/email/default.html
+++ b/files/templates/email/default.html
@@ -2,6 +2,8 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html>
 	<head>
+		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<meta name="x-apple-disable-message-reformatting" />
 		<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
diff --git a/files/templates/login.html b/files/templates/login.html
index ab08d1a39..6bc0d9b05 100644
--- a/files/templates/login.html
+++ b/files/templates/login.html
@@ -3,6 +3,8 @@
 <html lang="en">
 
 <head>
+	<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+
 	<script src="/assets/js/bootstrap.js?v=1"></script>
 
 	<meta charset="utf-8">
diff --git a/files/templates/login_2fa.html b/files/templates/login_2fa.html
index 543ee6ebd..7f6360190 100644
--- a/files/templates/login_2fa.html
+++ b/files/templates/login_2fa.html
@@ -3,6 +3,7 @@
 <html lang="en">
 
 <head>
+		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
 
 		<meta charset="utf-8">
 		<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
diff --git a/files/templates/settings.html b/files/templates/settings.html
index ef7b0be9a..592c50d9c 100644
--- a/files/templates/settings.html
+++ b/files/templates/settings.html
@@ -2,6 +2,8 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
+	<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+
 	<script src="/assets/js/bootstrap.js?v=1"></script>
 
 	<meta charset="utf-8">
diff --git a/files/templates/settings2.html b/files/templates/settings2.html
index 09f259690..8b2088c04 100644
--- a/files/templates/settings2.html
+++ b/files/templates/settings2.html
@@ -3,6 +3,8 @@
 <html lang="en">
 
 <head>
+	<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+
 	<script src="/assets/js/bootstrap.js?v=1"></script>
 
 	<meta charset="utf-8">
diff --git a/files/templates/sign_up.html b/files/templates/sign_up.html
index 7805104ea..5e2d3f269 100644
--- a/files/templates/sign_up.html
+++ b/files/templates/sign_up.html
@@ -2,6 +2,8 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
+		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+
 		<script src="/assets/js/bootstrap.js?v=1"></script>
 
 		<meta charset="utf-8">
diff --git a/files/templates/sign_up_failed_ref.html b/files/templates/sign_up_failed_ref.html
index e6cc16c76..1d2cb9941 100644
--- a/files/templates/sign_up_failed_ref.html
+++ b/files/templates/sign_up_failed_ref.html
@@ -3,6 +3,8 @@
 <html lang="en">
 
 <head>
+		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+
 		<script src="/assets/js/bootstrap.js?v=1"></script>
 
 		<meta charset="utf-8">
diff --git a/files/templates/submit.html b/files/templates/submit.html
index dc5aa7b38..1492e328d 100644
--- a/files/templates/submit.html
+++ b/files/templates/submit.html
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
+		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+
 		<script src="/assets/js/bootstrap.js?v=1"></script>
 
 		<meta charset="utf-8">
